Extracted

• • Target

    JaffaCakes118_87776b047a3f8f45b5c1986a38a9d540

  • Size

    575KB

  • MD5

    87776b047a3f8f45b5c1986a38a9d540

  • SHA1

    5d78b7db83b0c0e112732d74e5765dc62d984a23

  • SHA256

    5635680db784458c202b66ff6a022282c6785e65724aa127ce701bfa3cde17e1

  • SHA512

    950112b654a7e5329c5da889c4cdd0257a2b757f059d7b78a9059fe4a8a7b518d816551d7708f375f1bfadafad4e8c54ecfbf3ecfb3983ef5be1135d99e439c5

  • SSDEEP

    6144:QUKjV0YWWy9zF38G+9PddNZxmirWR06XkqxLV4HtDnyv96GvKrqD+44dWPn:YjVtWWqh38G+9P/x16N7V4brqDL4k

  Score

  10^/10

  discoverycybergateremotepersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2